VMware App Volumes User Guide. VMware App Volumes 2.12

Transcription

1 VMware App Volumes User Guide VMware App Volumes 2.12

2 You can find the most up-to-date technical documentation on the VMware website at: If you have comments about this documentation, submit your feedback to VMware, Inc Hillview Ave. Palo Alto, CA Copyright 2016 VMware, Inc. All rights reserved. Copyright and trademark information. VMware, Inc. 2

3 Contents About This Book 5 1 Introduction to VMware App Volumes 6 App Volumes Architecture 8 Suggested App Volumes Workflow 10 App Volumes Manager Console 11 2 System Requirements 13 Software Requirements 13 Infrastructure and Networking Requirements 14 3 Installing App Volumes 16 User Accounts and Credentials 16 Install App Volumes Manager 17 Install the App Volumes Agent 19 Verify License 20 Scaling App Volumes Manager 20 4 Configuring App Volumes Manager 22 Configuring and Using Active Directory 22 Configuring a Machine Manager 26 Configure Storage For AppStacks and Writable Volumes 27 Disable Microsoft Windows NTLM Authentication 29 5 Using SSL Certificates with App Volumes Manager 30 Configuring SSL Certificates for Machine Managers 30 Managing SSL Between App Volumes Manager and Agent 32 6 Working with AppStacks 38 Provisioning and Assigning AppStacks 38 Assign an AppStack 41 Edit an AppStack 42 Update an AppStack 42 Import AppStacks to App Volumes 43 Check Datastores for Available AppStacks 43 Setting AppStacks Precedence 44 Delete AppStacks 44 VMware, Inc. 3

4 7 Working with Writable Volumes 45 Create a Writable Volume 46 Import Writable Volumes 48 Update Writable Volumes 49 Rescan Writable Volumes 49 Considerations and Limitations for Writable Volumes 49 Expand a Writable Volume 50 8 Upgrading App Volumes Components 51 Upgrade App Volumes Manager 51 Upgrade the App Volumes Templates 52 Upgrade the App Volumes Agent 52 9 Advanced App Volumes Configuration 53 Batch Script Files 53 Configure Batch File Timeouts 53 Configuring SVdriver and SVservice 54 Create a Custom vcenter Server Role 57 Create a Custom vcenter Server Role Using PowerCLI 59 VMware, Inc. 4

5 About This Book The VMware App Volumes User Guide provides information on how to install, deploy, and configure VMware App Volumes. App Volumes is a real-time application delivery system that enterprises can use to dynamically deliver and manage applications. This guide also provides information on volume creation and storage, manage infrastructure using App Volumes Manager, and create, manage, and deploy AppStacks. Intended Audience This information is intended for VMware App Volumes administrators, virtual infrastructure administrators, and operations engineers who track and maintain the App Volumes infrastructure. VMware Technical Publications Glossary VMware Technical Publications provides a glossary of terms that might be unfamiliar to you. For definitions of terms as they are used in VMware technical documentation, go to VMware, Inc. 5

6 Introduction to 1 VMware App Volumes VMware App Volumes provides a system to deliver applications to desktops through virtual disks. Applications are bundled in AppStacks and delivered by attaching a standard VMDK file to a virtual machine. You can centrally manage the applications with the App Volumes Manager and there is no need to modify the desktops or individual applications. Applications delivered using App Volumes look and feel natively installed and you can update or replace the applications in real time. All applications are provisioned during login time and App Volumes users have a persistent user experience wherein they can install their own applications and have them persist across sessions. A typical App Volumes environment consists of a few key components that interact with each other and an external infrastructure. Table 1 1. App Volumes Components Component App Volumes Administrator App Volumes Manager Description Active Directory (AD) or organizational unit (OU) account. User must have local administrator privileges. Web-based interface integrated with Active Directory (AD) and vsphere. Consists of services that orchestrate application delivery and interface the vsphere environment. You can use App Volumes Manager for the following tasks: Manage assignments of volumes to users, groups, and target computers. Collect AppStacks and Writable Volumes usage information. Maintain a history of administrative actions. Automate assignment of applications and Writable Volumes for agents during desktop startup and user login. See Install App Volumes Manager and Chapter 4 Configuring App Volumes Manager. App Volumes database App Volumes agent A Microsoft SQL or SQL Server Express database that contains configuration information for AppStacks, Writable Volumes, and users. See Software Requirements. Software installed on all Windows desktops where AppStacks and Writable Volumes are assigned. See Install the App Volumes Agent. VMware, Inc. 6

7 Table 1 1. App Volumes Components (Continued) Component AppStacks Writable Volume Description This is a read-only volume containing one or more Windows applications. Once provisioned, an individual AppStack or multiple AppStacks can be mapped to a user, a group of users, or computers at login, or in real-time and to computers only at the time of startup. See Chapter 6 Working with AppStacks. Read and write volume for persisting user-specific information between sessions. You can use Writable Volumes to store the following data: User installed applications and application settings Application licensing information User and computer profile Data files Note Users can have more than one Writable Volume assigned to them. For details about using Writable Volumes and restrictions, see Chapter 7 Working with Writable Volumes. Provisioning Desktop Target Computer A clean virtual machine that contains the necessary applications for installation into AppStacks. The desktop must have the App Volumes agent installed and configured to connect to the App Volumes Manager. See Provisioning and Assigning AppStacks and Best Practices for Provisioning Virtual Machines and Applications. A VDI desktop, physical client computer, Remote Desktop Services (RDS) Host or Citrix XenApp Server where users log in to access their applications delivered from the AppStack. The target computer must have the App Volumes agent installed and configured to connect to the App Volumes Manager. VMware, Inc. 7

8 Table 1 1. App Volumes Components (Continued) Component VMware vcenter Server Storage Group Description App Volumes uses vcenter Server to connect to resources within the vsphere environment. See Configuring a Machine Manager. You can use Storage Groups to automatically replicate AppStacks or distribute Writable Volumes across many datastores. They are also used to define a group of datastores that should all contain the same AppStacks. Some of the attributes for the group, such as template location and strategy, only apply when using the group for distributing writable volumes. The distribution strategy setting controls how Writable Volumes are distributed across the group. Spread. Distribute files evenly across all the storage locations. When a file is created, the storage with the most available space is selected. Round Robin. Distribute files by sequentially using the storage locations. When a file is created, the storage with the oldest used time is selected. You can manage the capabilities of storage groups by selecting required storage and ignoring unwanted or slow-performing storages while mounting volumes. When you mark a storage as Not Attachable, the App Volumes Manager ignores the storage while mounting volumes. For example, you can set up two vcenter Server instances. Each server can have a local storage and shared storage capability. You can mark the slower-performing storage as Not Attachable. This storage is ignored by the App Volumes Manager while mounting volumes and can be used solely for replication of AppStacks. This chapter includes the following topics: App Volumes Architecture Suggested App Volumes Workflow App Volumes Manager Console App Volumes Architecture App Volumes installs an additional virtualization layer on top of the guest operating system which detaches the application, user settings, and user data layers from the virtual machine (VM). As a result, applications, user settings, and user data become independent from the VM and can be moved across data centers and shared with other VMs. VMware, Inc. 8

9 Figure 1 1. App Volumes Architecture VM AppStacks Writable Volumes Acrobat Office Java Outlook Chrome Firefox App Volumes Agent Read I/O OS Read and Write I/O vsphere AppStacks Writable Volumes In a traditional vsphere deployment, a VM consists of a guest OS, applications, user settings, and user data all in a single VMDK file. A copy of the VMDK file is created on the vsphere datastore for every user of a VM. You cannot manage applications, user settings, and user data independently of the VM. App Volumes detaches the guest OS from the applications, user settings, and user data by installing the App Volumes agent on top of the guest OS. With App Volumes, you deliver applications and user settings through two types of containers, AppStacks and Writable Volumes. AppStacks and Writable Volumes are VMDK files that reside on top of the App Volumes agent. Unlike the traditional VM architecture, only one copy of each AppStack and Writable Volume exists on the vsphere datastore. You can manage AppStacks and App Volumes independently of the VM. VMware, Inc. 9

10 AppStacks AppStacks are read-only containers that you can use to deliver applications to your users. You can create multiple AppStacks and provision them with different sets of applications depending on the needs of your users. For example, you can create one AppStack with development tools and another one with core applications such as Microsoft Office. You assign AppStacks to Active Directory user or computers accounts, groups or OUs. When a user logs in to a VM, the AppStack is attached to that VM and the applications on the AppStack become available to the user. You can change or update the applications in every AppStack individually and deliver the new version of the AppStack to your users. For information about how to create and manage AppStacks, see Chapter 6 Working with AppStacks. Writable Volumes Writable Volumes are read-write containers that you can use to enable your users to install their own applications and to store their settings. Writable Volumes can migrate with their users across different computers and systems. One user can use only one Writable Volume at a time. For more information about Writable Volumes, see Chapter 7 Working with Writable Volumes. Suggested App Volumes Workflow After installing App Volumes, you must perform certain tasks before you can deploy and manage applications. 1 Install the App Volumes Manager. See Install App Volumes Manager. 2 Configure the Active Directory. See Register an Active Directory Domain. 3 Configure SSL and SSL certificates. See Chapter 5 Using SSL Certificates with App Volumes Manager. 4 Select the Active Directory group responsible for administering the App Volumes Manager. See Add Administrators. 5 Set up the operation mode. See Set Up the Machine Manager Connection. 6 Select datastores and paths to store AppStacks and writable volumes. See Configure Storage For AppStacks and Writable Volumes. 7 Set up roles and permissions. See Configure VHD In-Guest Storage. 8 Install App Volumes agents and other components. See Install the App Volumes Agent. 9 To perform advanced configurations, see Chapter 9 Advanced App Volumes Configuration. VMware, Inc. 10

11 App Volumes Manager Console The App Volumes Manager provides information about the different App Volumes components and configurations that are available to you. Tab Name and Action Dashboard Details Provides the following information: The number of user and server licenses in use User utilization Most recent user logins Computer utilization Most recent computer logins AppStack utilization Most recent AppStack attachments Volumes Directory Infrastructure Used to create and manage AppStacks and Writable Volumes and for monitoring currently attached volumes. Shows information about users, computers, groups, and OUs that have assignments or were logged in to the computer that has the App Volumes agent installed. Active Directory objects are automatically synchronized with App Volumes database every 4 hours. To force synchronization, click Sync under the Directory tab. Shows information about computers and storage that are seen by the App Volumes Manager. You can also configure new storage groups and get details about existing configured groups. VMware, Inc. 11

12 Tab Name and Action Activity Configuration Details Monitor the App Volumes Infrastructure: Pending Actions: Displays actions waiting to be performed in the background and will be completed in the order submitted. Activity Log: Displays records of system activity such as user logins, computer power-ups, volume attachments, and so forth. System Messages: Displays messages and errors generated by internal events such as volume attachment and Active Directory access. Use these tabs to change the settings specified during App Volumes Manager installation: License: Contains information about the license. A valid license issued is required to use this management console. Active Directory: Provides information about your active directory. App Volumes uses the Active Directory to assign AppStacks to users, computers, and groups. Administrators: Choice of the Active Directory group responsible for administering the App Volumes Manager. Machine Managers: Login credentials for the vcenter Server. Storage: Set the default database where AppStacks and writable volumes are stored. Click the Cloud icon in the top left corner of the App Volumes Manager to return to the home page of the console. VMware, Inc. 12

13 System Requirements 2 You must verify that your system meets the requirements for installing VMware App Volumes. This chapter includes the following topics: Software Requirements Infrastructure and Networking Requirements Software Requirements Ensure that your system meets certain database and browser requirements when working with App Volumes. Database Requirements App Volumes Manager supports different versions of the Microsoft SQL database. SQL Server 2012 SP1, SP2, and SP3 (whenapp Volumes Manager is installed on Microsoft Server 2012 R2), Express, Standard, and Enterprise editions SQL Server 2008 R2 SP2, Express, Standard, Enterprise, and Datacenter editions SQL Server 2014 SP1 and SP2 (supported on App Volumes 2.12 and later) SQL Server 2016 SP1 For High Availability, App Volumes supports the following database features : SQL Server Clustered Instances SQL Server Mirroring Browser Requirements Use App Volumes Manager on one of the following supported browsers: Internet Explorer 9 or later Mozilla Firefox 28 or later Safari 7 or later Google Chrome 21 or later VMware, Inc. 13

14 Infrastructure and Networking Requirements Infrastructure and networking requirements for App Volumes include requirements for App Volumes Manager, agent, and Active Directory. Table 2 1. Infrastructure Requirements Component Details App Volumes Manager Microsoft Windows Server 2008 R2, Standard, Enterprise, or Datacenter editions Microsoft Windows Server 2012 R2 Standard and Datacenter editions Microsoft Windows Server 2016.NET 3.5 framework 4 vcpu required 4 GB RAM 1 GB disk space App Volumes Agent (client OS) Windows Server 2008 R2 and 2012 R2 for Server VDI Microsoft Windows 7 SP1 Professional and Enterprise editions (Microsoft Hot fix applied) Microsoft Windows 8.1 Professional and Enterprise Microsoft Windows 10 Build 1607 Current Branch & LTSB Microsoft Windows 10 Build 1607 Current Branch for Business Windows 10 Anniversary edition Version 1607 Both 64-bit and 32-bit versions of OS are supported 1 GB RAM 5 MB disk space Note Disable the GPO Control Read and Write Access to Removable Devices or Media option. App Volumes Agent (RDSH) Microsoft Windows Server 2008 R2 Standard, Enterprise, and Datacenter editions with RDSH role enabled Microsoft Windows Server 2012 R2 Standard and Datacenter editions with RDSH role enabled Microsoft Windows Server 2016 with 2K16 1 GB RAM 5 MB disk space VMware software for VMDK Direct Attached Mode (Preferred) VMware ESXi 5.5.x, 6.x and vcenter Server (ESXi and vcenter Server must be the same version) VMware Virtual SAN 6.2 VMware Horizon with View or later Citrix XenDesktop 5.5, 5.6, and 7.x Citrix XenApp 6.5 and 7.x ESXi 5.5 U3b or 6.0 U1 required for vmotion support (Storage vmotion is not supported) VMware, Inc. 14

15 Table 2 1. Infrastructure Requirements (Continued) Component Details SMB file share if using VHD mode SMB 2.0 SMB version 3.02 (Windows Server 2012 R2) is recommended for a better performance Active Directory Microsoft Active Directory domain, 2003 functional level or later. Read-only account access. Table 2 2. Networking Requirements Component Purpose Port number App Volumes Manager Agent and Manager communications TCP 80 (HTTP) TCP 443 (HTTPS) TCP 5985 for PowerShell Web services App Volumes SQL Database Database communication TCP 1433 (SQL) VMware, Inc. 15

16 Installing App Volumes 3 Installing App Volumes involves installing the App Volumes Manager, App Volumes agents, and related components. Before installing App Volumes, ensure that you have created and set up the requisite user accounts and Active Directory credentials. This chapter includes the following topics: User Accounts and Credentials Install App Volumes Manager Install the App Volumes Agent Verify License Scaling App Volumes Manager User Accounts and Credentials Users and administrators require certain account permissions to install and manage App Volumes components. User Accounts You can create user accounts and grant privileges for different roles. User names must contain only ASCII characters: To integrate App Volumes with vcenter Server, you must create a service account within a vcenter Server with administrator privileges. Optionally, you can create a service account with privileges granted by a custom user role. If you plan to use a direct connection to the ESXi host or plan to use the Mount to Host option with a vcenter Server connection, you must have administrator privileges on all ESXi hosts. VMware, Inc. 16

17 Active Directory Credentials The App Volumes Manager connects to Active Directory using the service account. To prepare for installation, you must create an account within the Active Directory domain that meets the following requirements: Provides read access to the Active Directory domain. Administrator privileges are not required. Has a password that does not expire. If your environment contains domains that are configured for one-way or two-way trust, you can configure separate credentials to access these domains. These credentials are used when connecting to any trust instead of the primary domain credentials. Administrators Group Access to the App Volumes Manager is restricted to the App Volumes administrators group. When you perform the initial configuration, you must provide the name of the Active Directory security group that will have access to the App Volumes Manager. Local administrator privileges are required for the following actions: Install App Volumes components on target servers. Use writable volumes with user-installed applications. Provision AppStack. Note The Active Directory service account user is not required to be an administrator. Install App Volumes Manager App Volumes Manager is a Web console that is used for administration and configuration of App Volumes and assignment of AppStacks and writable volumes. Prerequisites Download the App Volumes installer. Ensure that you have the SQL Server authentication details with you. Verify that your environment meets the system requirements. See Infrastructure and Networking Requirements and Software Requirements. Verify that your account has local administrator privileges on the target server. 1 Run the setup.exe installer file. 2 Read and accept the End-User License Agreement and click Next. 3 Select Install App Volumes Manager and click Next. VMware, Inc. 17

18 4 Select a database option: Option Local installation of SQL Server Express Remote SQL Server 2012 Description The database is installed automatically. Enter the required server authentication details. 5 Select the database connection method. Option Windows Integrated Authentication SQL authentication Description Provide owner permissions on the new database to the App Volumes Manager server. Create a user and provide owner permissions to the user on the new database. A new ODBC connection named svmanager is created. 6 Select the Overwrite existing database (if any) check box and click Next. Note Ensure that the Overwrite existing database (if any) check box is deselected when you upgrade App Volumes or install an additional instance of App Volumes Manager. 7 Select the ports on which App Volumes Manager can listen for incoming connections. By default, communication occurs over SSL and the default value of the port is 443. Specify the port value as 80 (or equivalent) for App Volumes Manager to listen on a HTTP port. 8 (Optional) Check the Allow Connections over HTTP (insecure) box. If you have specified the App Volumes Manager to listen on a HTTP port in Step 7, you must check this box. Checking this box disables SSL and all communication with App Volumes Manager becomes insecure. Caution Do not enable HTTP in a production environment. 9 Click Next and enter the path where App Volumes Manager should be installed.. 10 Click Install to begin the installation. What to do next Configure the connection to the SQL database. See Configure a SQL Server ODBC Connection. Configure SSL for App Volumes Manager. See Chapter 5 Using SSL Certificates with App Volumes Manager. Configure App Volumes Manager and related components. See Chapter 4 Configuring App Volumes Manager. Configure a SQL Server ODBC Connection When you install App Volumes Manager, a new ODBC connection is created. You must configure a connection to the SQL database and set up the required permissions. VMware, Inc. 18

19 See the Microsoft SQL ODBC documentation for instructions about configuring the SQL Server ODBC connection. Prerequisites Verify that svmanager_setup.exe executable is located on the machine where App Volumes Manager is installed. 1 Log in as administrator to the machine where App Volumes Manager is installed. 2 Navigate to C:\Program Files (86)\Cloud Volumes\Manager. 3 Run svmanager_setup.exe. 4 Follow the on-screen instructions to connect to the database and set up permissions. Install the App Volumes Agent After you have installed App Volumes Manager, install the App Volumes agent on the provisioning computer and target desktops. For improved security when using the App Volumes agent, disable weak ciphers in SSL and TLS to ensure that Windows-based machines running the agent do not use weak ciphers when they communicate using SSL/TLS protocol. See Disable Weak Ciphers in SSL and TLS in the Horizon 7 documentation. Important Do not install the agent on the same machine where the App Volumes Manager is installed. Prerequisites Ensure that you have installed the App Volumes Manager and you have the host IP address and port number. Verify that your environment meets the system requirements. See Chapter 2 System Requirements. Verify that your account has local administrator privileges on the target computer. Install Windows Updates from January 2016 onwards on the target computer. If you intend to use this virtual machine as a provisioning computer, create a clean snapshot or take a back up of this machine. Revert to this snapshot or the back up before provisioning new AppStacks. 1 Run the App Volumes installer. The same installer is used to install the App Volumes Manager and the agent. 2 Read and accept the End User License Agreement and click Next. 3 Select Install App Volumes Agent and click Next. VMware, Inc. 19

20 4 Enter the IP address and port number. The default port number for App Volumes Manager is 443. Enter 80 for the port number if you have configured App Volumes Manager to listen on a HTTP port. 5 (Optional) Check the Disable Certificate Validation with App Volumes Manager box if you do not want the agent to validate the App Volumes Manager certificate. Certificate validation is enabled by default. 6 Click Install and follow any on-screen instructions. 7 Click Finish to exit the wizard after the installation is completed. 8 Restart your provisioning virtual machine to complete the agent installation. What to do next Configure SSL certificates for the agent. See Import Default Self-Signed Certificate. You can also disable SSL communication and certificate validation between App Volumes Manager and agent. See Disable SSL Certificate Validation in App Volumes Agent and Disable SSL in App Volumes Agent. Verify License You must verify the App Volumes license information before configuring other components. A valid license is required to activate and use App Volumes. Prerequisites Ensure that you have downloaded and installed the App Volumes license file. The production license file can be downloaded from the VMware App Volumes product download page. 1 From the App Volumes Manager console, click Get Started > License. 2 Verify the license information that is displayed. If you have an evaluation license, you can use App Volumes until the expiration date. 3 (Optional) To apply a different license, click Edit and browse to the location of the license you want to upload. 4 Click Upload to upload the App Volumes license file. 5 Click Next and follow on-screen instructions. Scaling App Volumes Manager You can install an additional App Volumes Manager component on multiple servers and point them to a shared SQL database. VMware, Inc. 20

21 Multiple App Volumes Managers can be load balanced by a hardware load balancer. Alternatively, you can configure the App Volumes agent to communicate with multiple App Volumes Manager servers. To install additional App Volumes Manager instances, follow standard installation procedures and point a new instance to the existing SQL database. See Install App Volumes Manager. Note Ensure that the Create a new database or overwrite the existing database check box in the installation wizard is deselected. While configuring an App Volumes agent, you can specify the load balanced FQDN of the App Volumes Manager. Configure the App Volumes agent to communicate with multiple managers by modifying the following registry key: HKLM\SYSTEM\CurrentControlSet\Services\svservice\Parameters Add string values named ManagerN (where N is number from 0 to 9) and value data of App Volumes Manager FQDN. VMware, Inc. 21

22 Configuring App Volumes 4 Manager You must configure the App Volumes Manager after installing it. Configuring the App Volumes Manager involves setting up the Active Directory, group administrative access, storage access settings, and also validating host credentials. After configuring the App Volumes Manager, you can create and work with specialized containers known as AppStacks and Writable Volumes. This chapter includes the following topics: Configuring and Using Active Directory Configuring a Machine Manager Configure Storage For AppStacks and Writable Volumes Disable Microsoft Windows NTLM Authentication Configuring and Using Active Directory You use Active Directory in App Volumes to assign applications and writable volumes to users, groups, computers, and Organizational Units (OUs). As an administrator with full access to App Volumes Manager, you can configure and work with Active Directory domains and users in many ways: Add multiple Active Directory domains and assign unique credentials and administrator access to users from these domains. Assign writable volumes to a specific user. Filter entities based on their domain. Search across multiple Active Directory domains. Manage assignments for any user, group, or computer from any configured Active Directory domain. Add multiple domain controller hosts. Active Directory Objects Lookup App Volumes Manager looks up Active Directory objects by their GUID instead of UPN (User Principal Name). Hence administrators can move users across domains and organizational units (OUs) and even rename users and computers without affecting their AppStacks or Writable Volumes assignments. VMware, Inc. 22

23 Automatic Active Directory Synchronization App Volumes Manager maintains a database record for any Active Directory that is seen by an App Volumes agent or assigned to an AppStack or a Writable Volume. A background job runs every hour to synchronize up to 100 entities in the Active Directory. If there are more than 100 objects, then the next batch of 100 objects is synchronized in the hour after the first batch of objects has been synchronized. Note GUID synchronization from Active Directory servers might take up to a week and it varies based on the number of objects that are present in the system. Enable Secure Communication Between App Volumes Manager and Active Directory When you configure an Active Directory, you can choose to have App Volumes Manager communicate securely with the Active Directory. Prerequisites Download the root certificate of the Active Directory to the machine where App Volumes Manager is installed. If the root certificate is not in PEM (Base64 encoded) format, see the OpenSSL or similar documentation to convert the file to PEM format. 1 Log in as administrator to the machine where App Volumes Manager is installed. 2 Navigate to the location where you downloaded the root certificate. 3 Rename the root certificate file to adca.pem. 4 Copy the file under manager_root/config directory. You can now use LDAPs when you register an Active Directory. See Register an Active Directory Domain. What to do next If you choose LDAPs when you register an Active Directory, App Volumes Manager checks for the validity of the Active Directory certificate. If the certificate is valid, LDAPs is enabled. If the certificate is invalid, you will get an error and will not be able to proceed further with creating an Active Directory. Adding and Configuring Domain Controller Hosts You can add a single domain controller host or multiple hosts when you register an Active Directory. VMware, Inc. 23

24 You might configure multiple domain controller hosts to ensure redundancy and failover operations. If the primary domain controller that App Volumes Manager is connected to goes down, then App Volumes Manager can perform a failover and switch to a different host. This ensures that App Volumes users are unaffected by the downtime and can continue their operations without interruption. You can choose how App Volumes Manager detects domain controllers. Consider the following when you add domain controllers: If you provide a list of domain controllers, App Volumes Manager looks for a domain controller only in the list you provided. If the domain controllers in the list are all down, App Volumes Manager does not search for or detect any other domain controller. If you do not provide a list of domain controllers, App Volumes Manager detects domain controllers automatically and also assigns a priority to them. App Volumes Manager will search for and try to connect to domain controllers from the same site. Domain controllers from other sites are also added in order of binding time. Note Domain controllers in the same site always have higher priority over those from different sites. Refresh Domain Controllers The list of available domain controllers is refreshed every 480 minutes (8 hours). Use the environment variable, TIME_TO_REFRESH_DOMAIN_CONTROLLERS, to change the default time of 8 hours. Note You must set the time in minutes. Register an Active Directory Domain App Volumes uses Active Directory to assign application to users, computers, groups, and organizational units (OUs). If you want use a secure connection to connect App Volumes Manager to the domain controller, see Enable Secure Communication Between App Volumes Manager and Active Directory. Prerequisites 1 From the App Volumes Manager console, go to Configuration > Active Directory > Register Domain. VMware, Inc. 24

25 2 Enter the Active Directory configuration information and click Create. Parameter Active Directory Domain Name Domain Controller Hosts (Optional) Description A fully qualified domain name of the Active Directory domain where users and target computers are residing, for example corp.example.com. IP address ( ) or FQDN (dc01.corp.example.com). You can also provide the virtual IP address of a load balancer that is used as the front-end server of the domain controller. This option provides High Availability (HA) capability for connections to Active Directory. You can add multiple domain controller hosts; use commas to separate the names of the hosts. Important If you do not add a domain controller host, the system will detect the hosts that are available and connect to the nearest domain controller. LDAP Base (Optional) Username Password Use LDAPs (Optional) Port (Optional) Distinguished name of the Active Directory container or organizational unit that stores required entities (if you want to limit the scope of enumeration). By default, App Volumes Manager enumerates all users, groups, OUs, and computer objects within Active Directory. Example: OU=Engineering, DC=corp, DC=vmware, DC=com The user name of the service account that has access to the target Active Directory domain. For example, admin-1. The user can be an administrator with read-only permissions. The password for the service account. Ensure that domain policies do not enforce password expiration for the service account. Check the Use Secure Connection box if your domain controllers are configured with TLS certificates for LDAP connections. Check the box to encrypt communication between App Volumes Manager and the domain controller. A port number other than the default. Add Administrators Add an App Volumes administrator group who can log in to the App Volumes Manager and manage the users and groups. You can create multiple administrator groups for a single Active Directory domain. Note You cannot configure a single user an administrator, only a group can be added as an administrator. Prerequisites Verify that you have already added the group to the Active Directory database. 1 From the App Volumes Manager console, click Configuration > Administrators > Add Administrator. VMware, Inc. 25

26 2 Search the domain for the group to which you want to provide administrator privileges and select All to search in all domains or select a specific domain from the drop-down menu. You can filter the search query by Contains, Begins, Ends, or Equals. a (Optional) Check the Search all domains in the Active Directory forest box to search all domains in the entire Active Directory forest. A drop-down menu displays the groups matching your search query. 3 Select the Active Directory group from the list. 4 Click Create. All users within the group are granted administrator privileges. What to do next After you have added the administrators, you can configure the Machine Managers and App Volumes storage. See Configuring a Machine Manager and Configure Storage For AppStacks and Writable Volumes. Configuring a Machine Manager The App Volumes operation mode is determined by configuring the Machine Manager. The Machine Manager determines the type of hypervisor connection. Three types of hypervisor connections are available. You can configure the hypervisor to connect to one of the following hosts using the App Volumes Manager console. Table 4 1. Hypervisor Connection Types Hypervisor Connection Type VMware vcenter Server Single ESXi Host VHD In-Guest Services Description Preferred connection type for mid-to-large environments. Enables the use of VMDK Direct Attached operation mode. When using this connection type, you can assign AppStacks and writable volumes to the virtual machines running on multiple hypervisor hosts. Enables the use of VMDK Direct Attached Operation Mode, but only for a single ESXi host. Use this connection type for small deployments and proofs of concepts. You can assign AppStacks and writable volumes to the virtual machines running on a single hypervisor host. Disables other hypervisor connections and enables the use of VHD In-Guest operation mode. Use this connection type to assign AppStacks and writable volumes either to virtual machines running on an unsupported third-party hypervisor or to the physical computers. See Configure VHD In-Guest Storage. You cannot change the operation mode after you configure the Machine Manager. However, if you have configured vcenter Server as the first Machine Manager, additional vcenter Server instances can be added and configured. VMware, Inc. 26

27 Set Up the Machine Manager Connection App Volumes operation mode is determined by configuring a machine manager. You cannot change the operation mode of App Volumes after you configure the machine manager. Prerequisites Ensure that the domain policies do not enforce password expiration for the service account on the machine manager to be configured. 1 From the App Volumes Manager console, click Configuration > Machine Managers. 2 Select and configure the machine manager. Connection Type vcenter Server ESXi (Single Host) VHD In-Guest Description Enter host name, user name, and password details. You can optionally enable the Mount Local or Mount on Host options. If you select a vcenter Server instance as the first configured machine manager, you can add and configure additional servers. Enter host name, user name, and password details for the ESXi host. Does not require any credentials. a (Optional) To view the permissions required by the service account, click Required vcenter Permissions. 3 Click Save. The configured machine manager is displayed on the Machine Managers page. What to do next See Establish a Secure vcenter Server Connection to connect App Volumes Manager securely to a vcenter Server. You can also create a custom role on the vcenter Server. See Create a Custom vcenter Server Role Using PowerCLI. Configure Storage For AppStacks and Writable Volumes You can select datastores and paths where AppStacks and writable volumes are stored. You can configure a Hypervisor or VHD In-Guest storage type. Volumes are attached only for virtual machines on the host. You can add available storage only when App Volumes Manager is configured in the VHD In-Guest mode. Otherwise, the list of storage locations and datastores is populated from vcenter Server. See Configure VHD In-Guest Storage. VMware, Inc. 27

28 Prerequisites Use a storage location that is accessible to all virtual machine host servers. When using VMDK Direct Attach Operation Mode, the App Volumes Manager requires local or shared storage to be configured on the hypervisor. 1 From the App Volumes Manager console, click Storage. If you have configured the storage options, click Edit to change the configuration. 2 Enter the Default Storage Location, Default Storage Path, and Templates Path for AppStacks and Writable Volumes and click Next. 3 Confirm your storage settings and click Set Defaults. 4 (Optional) Check Import volumes immediately to import the volumes immediately. This option does not allow you to perform administrative tasks while import is underway. 5 Verify the information you entered on the Upload Prepackaged Volumes page, select the volumes, and click Upload. The volumes packaged with this App Volumes Manager are uploaded to the selected datastore. Configure VHD In-Guest Storage To use App Volumes with VHD In-Guest Operation mode, the machines where the App Volumes Manager and agents are installed require special permissions on the CIFS file share. 1 On a file server, create a new empty folder. 2 Copy the contents of the Hypervisor\In-Guest VHD folder from the App Volumes installation media to the new folder. 3 Share the folder and grant full access permissions on the file share to everyone. 4 Configure NTFS permissions as described below. An Active Directory domain group might be used to manage permissions for the following roles: Managers: App Volumes Manager Agents: Machines that receive App Volumes and writable volumes assignments Capture Agents: Machines that are used for provisioning new App Volumes agents Table 4 2. NTFS folder permissions required for each role Folder Managers Agents Capture Agents apps Full Read Write apps_templates Read None None VMware, Inc. 28

29 Table 4 2. NTFS folder permissions required for each role (Continued) Folder Managers Agents Capture Agents writable Full Write or None None Note Write permissions are required by Agents when Dynamic Permissions are not enabled. writable_templates Read None None Disable Microsoft Windows NTLM Authentication NTLM (NT LAN Manager) authentication is used to make the communication between App Volumes Manager and agent more secure. When an App Volumes agent make an HTTP request to the App Volumes Manager, NTLM is used to authenticate the user and user account with the entry in the Active Directory. You can disable NTLM by defining a system environment variable on the machine where App Volumes Manager is installed. See to understand the implications of disabling NTLM. 1 Log in as administrator to the machine where App Volumes Manager is installed. 2 Open Control Panel and click System > Advanced System Settings > Environment Variables > New. The New System Variable window appears. 3 In the Variable name text box, enter AVM_NTLM_DISABLED. 4 In the Variable value text box, enter 1. 5 Restart the computer. The App Volumes Manager service also restarts. VMware, Inc. 29

30 Using SSL Certificates with App 5 Volumes Manager App Volumes Manager uses SSL to communicate with Machine Managers and App Volumes agents. You can configure, replace, import, disable, and manage the SSL certificates used for SSL communication and validation. You can add and upload trusted SSL certificates from the App Volumes Manager console to establish a secure connection to the vcenter Server and the remote SQL server. You can also replace the default App Volumes Manager certificates that are used for communication with App Volumes agents, disable SSL and SSL certificate validation, and enable an HTTP connection. This chapter includes the following topics: Configuring SSL Certificates for Machine Managers Managing SSL Between App Volumes Manager and Agent Configuring SSL Certificates for Machine Managers You can establish secure connections from App Volumes Manager to SQL Server and vcenter Server. Establishing a Secure SQL Server Connection If the instance of App Volumes Manager that you have installed connects to an SQL server, you can change the default Windows ODBC settings and connect securely to App Volumes Manager. Ensure that you have downloaded the SSL certificate on the SQL server instance and imported the certificate as a Trusted Certificate on to the machine where App Volumes Manager is installed. Change the ODBC settings on this machine. For detailed instructions, see Establish a Secure vcenter Server Connection You can securely connect to a vcenter Server from App Volumes using an SSL certificate. Prerequisites Ensure that the vcenter Server you are connecting to has a domain SSL certificate. The certificate must be verified and accepted by App Volumes. VMware, Inc. 30

31 1 From the App Volumes Manager console, click Machine Managers > Add Machine Manager. 2 Enter the required Machine Manager information and click Save. Option Type Host name User name Password Mount Local Mount on Host Description Enter vcenter Server The host name of the Machine Manager. For example, server.your-domain.local The user name with which you will access the machine. For example, YOURDOMAIN\administrator. The password for the user name. Select this option if your VM's datastore has local copies of volumes and you want to mount the local copies. Select this option if you want to connect directly to the VM host. This results in increased performance and decreases the burden on the vcenter Server. 3 Verify the certificate details. If the certificate is not trusted or verified, the following messages are seen: A window with details of the certificate (SHA1 fingerprint, period of validity) that is present in the vcenter Server. A message at the top right corner: Server error: SSL certificate is not verified and needs to be accepted to continue. 4 Click Accept to accept the certificate. You can also log in to the vcenter Server as an administrator and verify the SHA1 code. The Machine Manager is successfully added after the certificate is verified. 5 Click Certificate to view the certificate you added. If the certificate is changed on the vcenter Server after it has established a connection with App Volumes Manager, the Certificate not valid message is displayed when you log in to App Volumes Manager. Note You also see this message when you upgrade App Volumes to the latest version. 6 To validate the certificate again, select the vcenter Server under Machine Managers, click Certificate, and accept the certificate. You now have a trusted SSL certificate to connect to the vcenter Server. VMware, Inc. 31

32 What to do next When you upgrade App Volumes from an older version to the latest version, verify the connectivity of each machine manager. You might have to manually accept the certificate to retain the connection to vcenter Server. Managing SSL Between App Volumes Manager and Agent A default self-signed certificate is installed when you install App Volumes Manager. App Volumes agents use SSL to communicate with the App Volumes Manager and validate the certificate. Replace the Self-Signed Certificate with CA-signed Certificate A self-signed certificate is installed when you install App Volumes Manager. You can replace the default self-signed certificate by modifying the Nginx configuration file. Note The self-signed certificate is installed in the same location as the Nginx configuration file: C:\Program Files (x86)\cloudvolumes\manager\nginx\conf. Prerequisites Obtain an SSL certificate from a trusted Certificate Authority (CA). Download the CA-signed certificate that you obtained and the corresponding key to the machine where the App Volumes Manager is installed. Note down the location where the files are downloaded. If you provide a passphrase while generating the private key during the Certificate Signing Request (CSR), note down the passphrase. Verify that the common name on the CA-signed certificate is the same as the host name or the IP address of App Volumes Manager that you configured while installing the agent. Verify that the SSL key and certificate are both in PEM (Base64 encoded) format. Verify that the certificate and key are Nginx compliant. 1 Log in as administrator to the machine where the App Volumes Manager is installed. 2 Navigate to C:\Program Files (x86)\cloudvolumes\manager\nginx\conf and make a copy of the existing Nginx configuration file, nginx.conf. 3 Open the Nginx configuration file. 4 Edit the ssl_certificate and ssl_certificate_key variables in the Nginx configuration file to point to the path of the certificate and key files that you downloaded. 5 (Optional) If you had provided a passphrase for the CA-signed certificate, enter the passphrase for your certificate in the Nginx configuration file. 6 Save the configuration file. 7 Restart the App Volumes Manager service. VMware, Inc. 32

33 Example: Nginx Configuration File In this example, the appvol_ca1_vmware.com.crt and appvol_ca1_vmware.com.key are the default selfsigned certificates. server { server_name ; listen 3443; listen 443; listen [::]:443; ssl on; ssl_certificate appvol_ca1_vmware.com.crt; ssl_certificate_key appvol_ca1_vmware.com.key; ssl_session_cache builtin:1000; ssl_session_timeout 5m; root../public; What to do next You can download and add the CA-signed certificate to the trust store of the App Volumes agent directly. Import Default Self-Signed Certificate If you do not want to replace the default self-signed certificate in the App Volumes Manager, you can import the certificate and add it to the local trust store of the machine where the App Volumes agent is installed. If you have installed and configured multiple App Volumes Manager instances for use in all agent machines, then the self-signed certificates have to be imported from each App Volumes Manager instance to the agent machines. Prerequisites Obtain the IP address of the App Volumes Manager instance whose certificate you want to import. 1 Log in as an administrator to the machine where the App Volumes agent is installed. 2 In a Web browser, enter the host name or IP address of the App Volumes Manager in the form of A warning message that the SSL certificate is not validated is displayed. 3 Click the warning message and follow instructions to download the SSL certificate displayed in the browser. 4 Open the Microsoft Management Console (MMC) and import the downloaded SSL certificate. See for detailed instructions to import the SSL certificate after downloading it. VMware, Inc. 33

34 Disable SSL Certificate Validation in App Volumes Agent SSL certificate validation is enabled by default when you install the App Volumes agent. You can disable SSL certificate validation in the agent, either when you are installing the agent or after you have installed the agent. Note When you disable certificate validation, untrusted App Volumes Manager certificates are not validated, but communication between App Volumes Manager and agent still occurs over SSL. If you want to disable SSL completely, see Disable SSL in App Volumes Agent. Disable SSL Certificate Validation When Installing App Volumes Agent The App Volumes agent validates the SSL certificate of the App Volumes Manager during communication with the manager. You can disable the certificate validation when you are installing the agent. u When you install the App Volumes agent, select the Disable Certificate Validation with App Volumes Manager box on the App Volumes Agent window. Certificate validation is disabled but communication with the manager still occurs over SSL. Disable SSL Certificate Validation in App Volumes Agent After Installation You can disable SSL certificate validation after you have installed the agent. 1 Log in as administrator on the machine where the App Volumes agent is installed. 2 Click the Start menu in Windows and enter regedit to open the Registry editor. 3 In the Registry Editor, go to HKLM\System\CurrentControlSet\Services\svservices\Parameters. 4 Locate and set the EnforceSSlCertificateValidation key to 0. The SSL certificate is no longer validated. 5 Restart the App Volumes service. SSL certificate validation is disabled in App Volumes agent. Enable HTTP in App Volumes Manager You can enable an HTTP connection in App Volumes Manager, either when you are installing the manager or after installation. VMware, Inc. 34